diff --git a/.github/workflows/publish-rust.yml b/.github/workflows/publish-rust.yml
index 41e9cead..9283d4e4 100644
--- a/.github/workflows/publish-rust.yml
+++ b/.github/workflows/publish-rust.yml
@@ -57,7 +57,7 @@ jobs:
 
       # crates.io trades this job's OIDC identity for a short-lived token, so
       # no long-lived token is stored anywhere.
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
 
       # docket-rs depends on the exact version of docket-rs-macros, so the